# Connect Azure SQL or SQL Server with Entra ID

## When to use this

You want SQL Server, Azure SQL Database or Synapse behind a swarmvia endpoint
and you would rather not create a SQL login at all. Microsoft's JDBC driver
accepts an Entra ID access token, which swarmvia mints for an app
registration. On-premises SQL Server with SQL logins works the same way with a
password instead.

## Setup

### 1. The identity

Register an application in Entra ID and create a client secret. In the
database, create a contained user for it and grant it reads:

```sql
CREATE USER [swarmvia-reader] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [swarmvia-reader];
```

`db_datareader` is the boundary; narrow it with schema-level `GRANT SELECT`
when the database holds more than the reader should see.

### 2. The source

**Sources → New source → JDBC data source → Microsoft SQL Server / Azure SQL /
Synapse.** The preset fetches `com.microsoft.sqlserver:mssql-jdbc` from Maven
Central. Placeholders: server (`acme.database.windows.net`), port `1433`,
database. The URL keeps `encrypt=true`.

### 3. The credential

**OAuth 2.0 client credentials**: token URL
`https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token`, the
application's client id and secret, scope
`https://database.windows.net/.default`, token property `accessToken`. The
driver takes a pre-minted token through `accessToken` alone; leave
`authentication` unset.

For a SQL login instead, the public property `user` on the source and the
secret property `password` on the credential.

### 4. Query

```bash
curl https://azure-sql.swarmvia.cloud \
  -H "X-Swarmvia-Key: $SWARMVIA_KEY" \
  -H "content-type: application/json" \
  -d '{"queries":[{"sql":"SELECT TOP (50) OrderID, CustomerID, OrderDate FROM Sales.Orders WHERE OrderDate >= ?","params":["2026-01-01"]}]}'
```

`source_schema` reads the driver's catalog, so schemas (`Sales`, `dbo`) and
tables list the way SQL Server names them.

## Tips

- Entra tokens for SQL last about an hour; swarmvia refreshes before expiry
  and sources sharing the credential share the token.
- Serverless Azure SQL resumes on the first connection after a pause; give
  the first query a statement timeout above the resume time.
- Synapse serverless pools work with the same preset; point the server at
  the `-ondemand` endpoint.

## See also

- [JDBC sources](/docs/sources/jdbc)
- [Refresh access tokens](/docs/knowledge-base/refresh-access-tokens)